Follow Us!

Windows XP Services Removal Guide

Windows Services List

I have made a complete list of the default System Services and some services that are not default. The "recommended" settings will not work on every computer configuration in the world, that would just make it all to easy :) However, they will work on most home computer configurations. Before using the recommended setting, I would recommend that you read the note beside each service. Some services may need to be left alone, after you have read the notes. Please do not forget to backup (See the backup section at the top of our guide).

Updates
I got an email from Jeroen Tulp, one of our oversea's viewers, and he said I should make this guide a little more newbie friendly, by replacing ENABLE with what it actually should be, like Automatic or Manual. Jeroen, has also been kind enough to send me a complete list of the services, and what "he" thinks each service should be set at. I didn't use all of his suggestions on them, but I did use the majority. Thanks for your input Jeroen!
I have also updated a couple descriptions. A few users have emailed me telling me why a certain service should be enabled. I have included what they said, about the service, in the description.
The emails just keep flowing in :) I was notified by Crystal Christensen, a Research Engineer for Microsoft, and she informed me about a few things about a certain service. The service she was explaining to me, was BITS, or Background Intelligent Transfer Service. I have included an update under the description of BITS. Crystal also states that by setting services to manual will not allow them to load, allowing the system to run faster, but also allows those services to be called upon and started when needed. (Windows will turn them on if they are needed). I already knew that, but just forgot to mention that in the guide. I have updated a few of the services "I think", should be set to manual.

Service Name

Recommended Setting

Notes

Alerter

Disable

Notifies users of administrative alerts. You can use the
Alerter service to have Performance Monitor send you a network pop-up
message and/or run a program when one of the counters exceeds a preset
threshold. You really should not have a need for this service. If you know
what it is and what it does, then you will know to leave it on.

Application Layer Gateway
Service

Manual

Used for Assign Publish
and Remove software services. Some users have emailed me and have told me
that their computer needs this service. I have it disabled, and I'm doing
fine. You should set this to manual, and if an application needs this
service, it will start, otherwise it will not.

Automatic Updates

Disable

Contacts Microsoft's web
site to see if there are any updates available for your computer. Honestly,
I would rather go to windowsupdate.microsoft.com and update my computer
rather than having it automatically update. Disabling this service will stop
automatic windows updates. If you disable this service, don't forget to
check for updates often!

Background Intelligent
Transfer Service

Manual

Transfers files
asynchronously between a client and an HTTP server. BITS only supports the
HTTP 1.1 protocol. BITS continues to transfer the files after the
application exits, as long as the user who initiated the transfer remains
logged on, and a network connection is established-BITS will not force a
connection.
I got an email from Crystal, the person I told you about a few mins ago, and
she say's disabling the Background Intelligent Transfer Service is not
necessarily wise as more programs than you realize actually use this
service. As well, RPC Locator that is important.

Used to store information
(cut/paste) and share it with other computers on the network.

COM+ Event System

Disable

I could not find a lot of
information about COM+ Event System but here is what I found at Microsoft's
site: The COM+ Events service uses an event class object to manage
the connection between publisher and subscriber. The event class object is a
COM+ component that is managed and stored by the COM+ Events system and
contains the interfaces and methods used by a publisher to fire events. It
is a persistent object that indicates the events that can occur and,
optionally, identifies the publisher. You specify the interfaces and methods
you want an event class to contain by providing a type library.

COM+ System Application

Disable

(See Com+ Event System
Notes)

Computer Browser

Manual/Disable*

The Computer Browser
Service component implements computer browsing functionality exposed by
Windows through Microsoft Networking. It allows a client machine to browse
its network neighborhood for available computers exposing file and print
sharing services. This service is not needed on a standalone system. If you
go to a lan party or you share files on your home network you might want to
turn this on manual. Otherwise you can Disable it.

Cryptographic Services

Automatic

Basically it confirms
signatures of Windows files You may always get a dialog box complaining
about uncertified drivers if this is disabled. Keep it enabled in order to
download updates from windowsupdate.microsoft.com

DHCP Client

Manual/Disable*

Receives a Dynamic IP
address from your DHCP server. If you have a static ip (An ip that doesn't
change) then you could turn this service off. If your on 56k or have a
dynamic ip on your network, leave it as it is. I believe if you're running
PPPoE software for your DSL, you must leave this on. Disable it only if you
know that you have a static IP address.

Distributed Link Tracking
Client

Disable

Maintains links with NTFS
files within your computer or across a domain. I don't think many people
would have a use for this unless you are on a corporate network.

What Microsoft has to say: "The distributed
link-tracking service enables client applications to track link sources
that have been moved. Clients that subscribe to the link-tracking service
can maintain the integrity of their references, and the objects can be
tracked in a manner that is transparent to the user."

Distributed Transaction
Coordinator

Disable

Microsoft says: "A
transaction manager that coordinates transactions that span multiple
resource managers. Work can be committed as an atomic transaction even if it
spans multiple resource managers, potentially on separate computers." I
don't exactly understand what all it does but I know when I have it
disabled, it does no harm. Note: This service is used by Microsoft Message Queueing (MSMQ) for doing development using message queueing or running applications that uses it. If this applies to you, then you should not touch this service.

DNS Client

Automatic

Used to resolves hostnames
on the Internet and Network. You should leave this on, for optimal Internet
surfing performance.

Error Reporting Service

Disable

When a serious error
occurs on your machine this service will phone home to Microsoft. I think
it's a security and privacy breach. I recommend disabling this service.

Event Log

Automatic

This allows Event Log
messages from applications to be viewed in Event Viewer. I have gotten an
email from a user saying this: "Service is need for diskeeper defrag and
remote access, auto connection manager plus remote access connection manager
is needed for Pal a compuserve connection to work". I recommend leaving it
enabled (automatic).

Fast User Switching
Compatibility

Manual/Disable

This service allows you to
quickly change the user that is logged in Windows. If you're the only user
that users your computer then you can disable this service.

Help and Support

Disable

The dreaded Help and
Support Service! This is the one I hate. It will automatically start and
will automatically change itself to "Automatic" mode when you click the Help
option on the start menu even if you have disabled the service! So if you
ever bring up the Windows Help, always go back to the services and disable
it again.

Human Interface Device
Access

Manual/Disable

Some peripherals may stop
working if you disable this service. I recommend setting it to manual so it
may start if it needs to. You can disable it and find out if it affects any
of your peripherals.

IMAPI CD-Burning COM
Service

Manual/Disable*

This service is required
for the built-in windows xp CD burning capability to operate. If you do not
have a CD writer or do not use the Windows built-in burning software, you
can disable this service.

Indexing Service

Disable

This service is a big
resource hog, mostly for the CPU and I/O operations of your hard drive(s).
The "Indexing" service is suppose to speed up searches when you are trying
to locate a file on your hard drive. I have found that it does more harm
than good. I would disable it.

Internet Connection
Firewall and Internet Connection Sharing

Manual/Disable*

If your sharing your
Internet access with other users on your network, leave this alone. Also, if
you are using the Built-in Windows Firewall you should leave this alone.
Otherwise if you are not using the built-in firewall (..but you are using
another firewall I hope?) and you do not share your Internet access then you
may disable this service.

IPSEC Services

Disable

This service controls many
security restrictions on your computer. The average joe does not need this
enabled.

Logical Disk Manager

Manual/Disable*

The Logical Disk Manager
Configuration Library component is the configuration engine for dynamic
disks. The component consists of a dynamic library that can be used to
convert disks to dynamic and back to basic, and manage the volumes residing
on dynamic disks. Management operations include create, delete, extend,
mirror, repair, and others. You may need to keep this service on manual. If
you do not plan to add hard drives or modify your partitions then you can
disable this.

Logical Disk Manager
Administrative Service

Manual/Disable*

Same as above.

Messenger

Disable

Disable this one! This is
the dreaded Windows Messenger service, not to be confused with MSN
Messenger. This service was originally made for administrators to send you
messages over the network. This service is now being exploited by spammers
to send you popup messages from over the Internet! Disable it. Disable it.
Disable it.

MS Software Shadow Copy
Provider

Manual

Used in conjunction with
the Volume Shadow Copy Service. I would leave this service on manual since
it will not automatically start with windows and can be started if it needs
to be.

Net Login

Manual/Disable*

This service allows your
machine to logon a domain controller. If you are not in a networked
environment you can disable this service, otherwise leave it on manual.

NetMeeting Remote Desktop
Sharing

Disable

Very bad idea to leave
this on manual or automatic. Net meeting users can view your desktop with
this service.

Network Connections

Automatic

Turning this off will
probably prevent your Internet from working. Leave it alone.

Network DDE

Disable

Microsoft says: "Network
DDE is used to initiate and maintain the network connections needed for DDE
conversations between applications running on different computers in a
network. A DDE conversation is the interaction between client and
server applications. You use network DDE along with DDE and the DDE
management library (DDEML) in your application." You can disable this.

Network DDE DSDM

Disable

See above.

Network Location Awareness
(NLA)

Manual/Disable*

The Network Location
Awareness Service component supports the Network Location Service. This
component provides the infrastructure that informs applications and the
operating system of the network connections on a specific computer and to
adapt to that computer's connectivity. You can disable this only if you are
NOT using Internet Connection Sharing.

NT LM Security Support
Provider

Disable

As far as I know, you only
need this service if you are running a telnet server. If anyone has any
other information about this service, please email me and let me know.
Thanks! Note: This service is used by Microsoft Message Queueing (MSMQ) for doing development using message queueing or running applications that uses it. If this applies to you, then you should not touch this service.

Performance Logs and Alerts

Disable

Collects performance data
on a schedule and sends the information to a log or triggers an alert.

Plug and Play

Automatic/Disable*

This service will
automatically detect and install new hardware you add to your computer. If
you are not planning on adding new hardware anytime soon, you can disable
this service. However, don't forget to enable it again before installing new
hardware!

Portable Media Serial
Number

Disable

Retrieves serial numbers
from portable music players connected to your computer. Disable it unless
something of yours ceases to function properly afterwards. I consider this a
privacy risk, as it will be contacting a server on the Internet and telling
them what music you listen to.

Print Spooler

Automatic/Disable*

I usually have this
disabled until I use my printer. If you don't ever use a printer, you can
disable it.

Protected Storage

Automatic/Disable*

Allows for the saving of
local passwords or even web sites information (AutoComplete.) Don't disable
if you use Autocomplete, otherwise for increase performance and extra
security disable it! Had a guy name Kevin email me and told me that if you
have MSN you will need to set this to auto.

QoS RSVP

Disable

Resource Reservation
Protocol (RSVP) is an IETF-draft networking protocol dedicated to being the
facilitator and carrier of standardized QOS information and parameters. RSVP
carries generic (industry-defined) QOS parameters from end nodes (inclusive)
to each QOS-aware network device included in the path between RSVP session
members. That is, RSVP is a means by which end nodes and network devices can
communicate and negotiate QOS parameters and network usage admission. I
recommend disabling this service as it uses resources and it is also a known
fact that is can cut your bandwidth speed by 20% for it's own use.

Remote Access Auto
Connection Manager

Manual/Disable*

Creates a connection to a network when a program requests a remote address.
If things cease to function after disabling this service, put it to manual.
(UPDATE) I have gotten word that this service along with the service below,
are needed for 56k and dailup connections. If you have a dialup connection
set this to manual. If you have problems, set it to automatic.

Remote Access Connection
Manager

Manual/Disable*

See above.

Remote Desktop Help Session
Manager

Disable

Yet another useless
security risk in Windows. Disable it.

Remote Procedure Call (RPC)

Automatic

Leave this on unless you
want to wreak havoc on your system! Almost every service requires this
service to be on.

Remote Procedure Call (RPC)
Locator

Disable

Microsoft Locator is the
default name service that ships with Microsoft® Windows NT®/Windows 2000.
The RPC run-time library uses it to find server programs on server host
systems. Prior to Windows 2000, Microsoft Locator did not provide persistent
name service entries. All entries in the name service were stored in a
memory cache on the server program's host computer. The locator used a
broadcast mechanism to discover the location of servers as requested by
clients. Whenever the host system shut down, all name service entries were
lost.

Remote Registry Service

Disable

Turn this off! This allows
remote users access to your registry!

Removable Storage

Automatic/Disable*

Used for managing
removable media. Disable this service if you do not have items like tape
backup devices, etc. If your CD ROM/DVD Drive starts acting funny, place
this service into Automatic. I also believe removable flash memory will
need this service left on. It's your call.

Routing and Remote Access

Disable

The average joe does not
need this service on. Turn it off unless you're in a corporate network
environment.

Secondary Logon

Disable

The only information I
have found about this is: "Enables starting processes under alternate
credentials." I have mine disabled and have found no problems.

Security Accounts Manager

Disable

This is like Protected
Storage, it's a security risk and needs to be turned off.

Server

Automatic/Disable*

If you share files,
internet, or printers across a network, leave this alone. Otherwise disable
it.

Shell Hardware Detection

Automatic

Used for the auto play of devices like memory cards, etc. Some laptops need
this, for their docking station.. This also disable Autoplay tab for CD/DVD
tabs.

Smart Card

Disable

If you do not have a
"Smart Card," or you do not know what a Smart Card is, you do not need this
service running.

Smart Card Helper

Disable

See above.

SSDP Discovery Service

Disable

Disable this, even
Microsoft says it's a security risk.

System Event Notification

Disable

Used in conjunction with
COM+ Event System, this service notifies particular services when system
events, such as logon and power events occurs.

System Restore Service

Automatic/Disable*

This service is required
for the Windows Restore to function. If you have no use for the system
restore, then you can disable this service. I'll leave it up to you :)

Task Scheduler

Disable

Disable this, it uses
resources.. If you have some Anti-virus software like Norton, it may depend
on this service to run auto virus scans, every week or something.. So the
choice is yours.

TCP/IP NetBIOS Helper
Service

Disable

If your network does not
use NetBios, disable this function. (This is a security risk, disable it)

Telephony

Automatic/Disable*

If you're on dialup leave
this alone. However if you got Cable, DSL with router, LAN connection
disable it. A guy named Craig, emailed me and told me that if your dsl is
PPPoE, then you need to turn this service on. However, if your DSL goes thru
your router, like myself, you can disable this service.

Telnet

Disable

Big security risk! Disable
this as it can allow users access to your system remotely.

Terminal Services

Automatic/Disable*

Allows remote login to the
local computer. This service is Required for Fast User Switching, Remote
Desktop and Remote Assistance. If you have those services disabled, then you
may disable this service.

Themes

Automatic/Disable*

Used to display the
graphical operations in Windows XP like the "Green Start Button" and other
graphical things. If you would rather go back to the old "Classic" graphical
user interface like Windows 2000 and Windows 98 then you can disable this
service and get a nice performance boost.

Uninterruptible Power
Supply

Disable

Unless you have a UPS
connected to your computer by a "serial or USB port" then you can disable
this service.

Universal Plug and Play
Device Host

Disable

Used in conjunction with
SSDP Discovery Service, it detects and configures UPnP devices on your home
network. Disable it for security reasons!

Upload Manager

Manual/Disable*

This service is needed for
the Internet Connection Sharing. If you have Internet Connection Sharing
disabled, you may disable this service.

Volume Shadow Copy

Disable

Shadow Copy Provider
service requires this service. If you have it enabled, leave this service
alone, otherwise you may disable it.

WebClient

Disable

I have never found a use
for this service. I have it disabled. If anyone knows more information about
this service, please let me know.

Windows Audio

Automatic

This service is required
if you want audio on your computer. If you're computer is a service, then
you could disable this service.

Windows Image Acquisition (WIA)

Manual/Disable*

This is used by cameras,
scanners, and digital video cameras. You can disable it and see if your
devices still work.

Windows Installer

Manual

Required to install
programs that use the .MSI Setup Installer.

Windows Management
Instrumentation

Automatic

Do NOT touch this service.

Windows Management
Instrumentation Driver Extension

Automatic

Read above.

Windows Time

Disable

Contacts time servers on
the Internet to set your clocks time. I would disable this privacy risk!

Wireless Zero Configuration

Manual/Disable*

You may disable this
service if you do not have any wireless (802.11a/b/g) devices.